I guess the security angle of not generating a string is similar to SQL injection against string vs parameterised query. e.g. (shell/sh (str "bash -c \"" user-input " && ls \"") This code might be a problem if user-input is && rm -rf * (warning: don't try to run this!) You can always start off with a string and then edit it into args before production.

ah yea totally stuff like this. In my example we ended up having a bug when you pass a string with ' then it counted as the next arg

https://caniuse.com/blobbuilder ~98% of tracked mobile, I think it is alright

Thanks! I wonder also about the encoding. Like is audio/mp3 going to be supported broadly, or is there some safer ground I should take.

I don't think Blob is doing any encoding at all. Maybe adds "audio/mp3" as a header? but idk

yeah, https://w3c.github.io/FileAPI/#blob-section from here it is just immutable reference to byte sequence

That's interesting. I've been wondering when the encoding is determined. Here is seems stuff is happening based on that param: • https://w3c.github.io/FileAPI/#attributes-blob which references: • https://w3c.github.io/FileAPI/#blob-package-data I'm not very good at parsing formal descriptions like this...